[FIX] web, openerp: debug mode now works without referer

In some cases the Referer HTTP header may be missing or
stripped by a proxy, browser extension or anti-virus.
This breaks debug mode because it was solely relying
on the Referer header.

Introducing an explicit X-Debug-Mode header for RPC
calls allows for an alternative method that works
even when the Referer is missing.

This won't work in all cases, e.g. for direct $.ajax
calls, for example.

Closes #9824

1 files changed, 7 insertions, 6 deletions

diff --git a/addons/web/static/src/js/framework/session.js b/addons/web/static/src/js/framework/session.js
index 3ae6ddb6649..7eae8b20a65 100644
--- a/addons/web/static/src/js/framework/session.js
+++ b/addons/web/static/src/js/framework/session.js
@@ -335,6 +335,11 @@ var Session = core.Class.extend(mixins.EventDispatcherMixin, {
         var self = this;
         options = _.clone(options || {});
         var shadow = options.shadow || false;
+        options.headers = _.extend({}, options.headers)
+        if (odoo.debug) {
+            options.headers["X-Debug-Mode"] = true;
+        }
+
         delete options.shadow;
 
         return self.check_session_id().then(function() {
@@ -350,18 +355,14 @@ var Session = core.Class.extend(mixins.EventDispatcherMixin, {
             if (self.origin_server) {
                 fct = ajax.jsonRpc;
                 if (self.override_session) {
-                    options.headers = _.extend({}, options.headers, {
-                        "X-Openerp-Session-Id": self.override_session ? self.session_id || '' : ''
-                    });
+                    options.headers["X-Openerp-Session-Id"] = self.session_id || '';
                 }
             } else if (self.use_cors) {
                 fct = ajax.jsonRpc;
                 url = self.url(url, null);
                 options.session_id = self.session_id || '';
                 if (self.override_session) {
-                    options.headers = _.extend({}, options.headers, {
-                        "X-Openerp-Session-Id": self.override_session ? self.session_id || '' : ''
-                    });
+                    options.headers["X-Openerp-Session-Id"] = self.session_id || '';
                 }
             } else {
                 fct = ajax.jsonpRpc;